A Personal Data Policy created for a website serves as an internal guideline and defines how the website stores and processes visitors’ personal data. Since 2018, when the General Data Protection Regulation (GDPR) came into force, stricter requirements have been imposed on the processing of personal data.
What Is It?
Personal Data
Personal data refers to any information that can directly or indirectly be linked to an identifiable natural person.
Direct personal data alone is sufficient to identify an individual, while indirect data may lead to identification when combined with other information.
Examples of personal data under GDPR include name, personal identity number, address, phone number, photographs, and email address.
Direct data includes, for example, a name or personal identity number, while an IP address and home address are examples of indirect personal data.
Personal Data Policy
All websites that process personal data must comply with GDPR. A fundamental requirement for processing personal data is that the website user provides explicit and informed consent. Visitors must be able to easily find information about how their data is processed — which is why a Personal Data Policy is required.
The Personal Data Policy must clearly state what personal data the website collects and stores, the purposes for which it is used, how visitors can manage their own data, and how they can contact the website owner.
How Does It Work?
A Personal Data Policy must be created for all companies and public entities that operate a website and process personal data.
The policy acts as an internal rule governing how personal data is handled. It must be clear, accurate, and easy to find. Once created, it must be published on the website so that every visitor can easily read it.
When setting up a website, it is also recommended to create a Cookie Policy — explaining how small text files store user data to improve the user experience — as well as Terms of Use, which define the rules for using the website.